SLTT Traffic Directing to S3 Buckets Hosting KrustyLoader

The Center for Internet Security^® (CIS^®) Cyber Threat Intelligence (CTI) team identified several Multi-State Information Sharing and Analysis Center^® (MS-ISAC^®) members directing DNS traffic to Amazon Web Services (AWS) Simple Storage Service (S3) buckets hosting KrustyLoader.

As analyzed by Synacktiv, KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems. At the time of publication, the CIS CTI team is not tracking confirmed U.S. State, Local, Tribal, and Territorial (SLTT) infections stemming from this activity, but members should exercise vigilance, as several of the identified S3 buckets remained active as of July 2026 and appeared to abuse legitimate companies' cloud storage accounts.

CTAs target legitimate cloud storage accounts to exploit AWS’s trusted reputation, making malicious downloads indistinguishable from normal cloud traffic to standard web filtering tools. CIS CTI cannot independently confirm the actor behind this activity, but open-source reporting from Volexity and EclecticIQ indicates threat actors have delivered KrustyLoader by exploiting internet-facing systems, including Ivanti and SAP NetWeaver appliances, and used that access to write and execute the loader on the compromised host for credential theft and long-term access.

How the CIS CTI Team Identified KrustyLoader

The CIS CTI team's investigation began following a CrowdStrike Falcon detection for an MS-ISAC member flagging Chrome activity connecting to kleinnretail[.]s3[.]amazonaws[.]com. The domain carried no malicious detections, but the team identified a specific object hosted at hxxps[://]kleinnretail[.]s3[.]amazonaws[.]com/uDTMypt5Y.

Analysts confirmed the file as KrustyLoader through two primary characteristics:

• Its configuration schema, which matched the structure published by Synacktiv in its research.
• Strings within the binary that included Rust crate dependency paths, specifically self-replace-1.3.5 and cfb-mode-0.7.1, which are consistent with KrustyLoader’s documented build.

The CIS CTI team observed that accessing the URL in a containerized environment produced an automatic file download followed by an immediate self-deletion attempt. This behavior is consistent with reporting from WithSecure and Synacktiv of KrustyLoader's anti-forensics capabilities.

A 30-day historical query in CIS’s Malicious Domain Blocking and Reporting (MDBR) portal identified nine U.S. SLTT member environments with successful DNS queries to domains confirmed as KrustyLoader staging infrastructure. CIS sent notifications to these members through the 24x7x365 U.S.-based CIS Security Operations Center (SOC). CIS CTI cannot independently confirm whether any of these resolutions resulted in a file download or execution.

The team submitted an abuse report to AWS for kleinnretail[.]s3[.]amazonaws[.]com. AWS confirmed removal of that bucket on July 9, 2026.

Inside the KrustyLoader Binary

Static analysis of the KrustyLoader binary retrieved from hxxps[://]kleinnretail[.]s3[.]amazonaws[.]com/uDTMypt5Y revealed the malware's capabilities and provided additional indicators. The static analysis also fully recovered the sample's embedded configuration and decryption keys, enabling the CIS CTI team to resolve the second-stage download location (hxxps[://]sellprolab[.]s3[.]amazonaws[.]com/oJ4kCFP0lcxvtR) and the Sliver command-and-control domain (hxxp[://]update[.]lotteofficial[.]org) without executing the malware.

The binary contained an encrypted configuration block with an embedded AES-128 key, initialization vector, and a single-byte XOR mask applied as a pre-decryption layer to the configured URL. Running the configuration ciphertext through the malware's three-step decryption sequence (hex-decode, per-byte XOR with the mask, then AES-128-CFB decryption) recovered the original staging URL, hxxps[://]sellprolab[.]s3[.]amazonaws[.]com:443/oJ4kCFP0lcxvtR, and confirmed the configuration decryption scheme. The decrypted configuration resolved the second-stage S3 location, which served an encrypted Sliver payload that produced zero detections in VirusTotal when scanned as a raw object at the time of analysis.

KrustyLoader decrypts the payload in memory, injects it into a live explorer.exe process using a dynamically resolved thread-creation function (RtlCreateUserThread), and then removes its own on-disk body, leaving Sliver running inside the trusted Windows process. The KrustyLoader binary also contained Rust crate dependency strings, specifically self-replace-1.3.5 and cfb-mode-0.7.1, which served as the basis for a content search to identify additional samples sharing the same build characteristics and surface the broader staging infrastructure described in the next section.

Decryption of the stage-2 payload using the same embedded key and initialization vector revealed a Sliver implant, as identified through its build information and symbol table, which contained the github[.]com/bishopfox/sliver import path as well as functions including main.beaconMain and main.beaconStartup. The stage-2 payload uses AES-128-CFB with the same key and initialization vector (IV) but no XOR pre-mask. The recovered build retained the full Sliver capability set, including interactive shell access, in-memory tool execution without writing files to disk, and a SOCKS5 proxy tunnel for lateral movement through the internal network.

Expanded Infrastructure for the Malware

To identify additional infrastructure associated with the activity, CIS CTI used a similarity hash search against the baseline sample, which returned approximately 100 candidate S3 URLs hosting 149 files sharing the exact size and similar structural characteristics. The team then refined that set using a VirusTotal content search for the Rust crate dependency string self-replace-1.3.5, which CIS CTI found in the binary while analyzing the KrustyLoader sample.

Unlike structural similarity, which can match across unrelated families, a specific Rust crate version string is a unique compiler-level build artifact. Its presence confirms the binary was built using the same code library as the baseline sample, making it a high-fidelity family indicator. That search returned nine samples across seven S3 buckets, per VirusTotal, with all carrying the KRABDRIP association tag of Google Threat Intelligence (GTI), which is GTI’s label for KrustyLoader.

Analysis of these buckets indicated they likely belonged to legitimate organizations before the threat actors took them over.

• Of the seven storage locations, four likely belonged to real identifiable organizations.
• The fifth bucket was likely a compromised legitimate platform that CIS CTI could not positively identify.
• Two locations appear to be attackercreated with naming conventions that suggest legitimate technology or retail infrastructure, but they have no identifiable registered owner.

CIS CTI determined bucket ownership through live content retrieval and reviewing Google-indexed documents predating the campaign window, indicating legitimate prior use of each identified bucket. Because downloads originated from familiar cloud infrastructure, standard web filtering tools are less likely to flag the traffic as malicious.

Open-Source Attribution of the CTA

CIS CTI cannot independently confirm the CTA behind this campaign, but the team notes several overlaps with vendor reports attributing a China-nexus actor to KrustyLoader delivery. CIS CTI independently confirmed omnileadzdev[.]s3[.]amazonaws[.]com/l9oWUjyPR6Gc as a KrustyLoader staging location through Rust crate fingerprinting, a URL which Symantec and Carbon Black along with Volexity have cited as infrastructure associated with the threat cluster GTI tracks as UNC5221 and Volexity labels UTA0178. GTI also applied a KRABDRIP designation, GTI's label for UNC5221-associated KrustyLoader activity, to samples identified in this investigation, further supporting the connection.

Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following:

• Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887)
• Ivanti Endpoint Manager Mobile (CVE-2025-4428)
• SAP NetWeaver (CVE-2025-31324)
• ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708)
• JetBrains TeamCity (CVE-2023-42793).

Defend against KrustyLoader as an MS-ISAC Member

The CIS CTI team recommends U.S. SLTTs join the MS-ISAC, a community dedicated to the Collective Cyber Defense of U.S. SLTTs. MS-ISAC members received early reporting on the KrustyLoader malware campaign, including over 200 indicators of compromise (IOCs) disseminated through our Indicator Sharing Program. Additionally, members can take advantage of proactive web security through the Malicious Domain Blocking and Reporting (MDBR) service. Finally, CIS CTI team provided membership with a more detailed report on the KrustyLoader campaign, including IOCs and recommendations. This information is intended to provide actionable threat intelligence that directly supports proactive Collective Cyber Defense in the U.S. SLTT community along with informed decision-making.

Ready to strengthen your defenses against malware like KrustyLoader?